HIPAA, Privacy & Security
PurpleTools RAF, PurpleTools Clicks, and PurpleTools Athena have been designed to be HIPAA-compliant within supported electronic health record systems.
PurpleTools does not transmit patient data, medication data, diagnosis data, laboratory data, clinical notes, or other clinical information across the Internet.
Clinical information is processed locally inside the user's Chrome browser. It remains within the existing EHR and browser environment.
PurpleTools Medical does not maintain a patient database, does not upload medical records to its servers, and does not send clinical information to an outside service for processing.
How PurpleTools Works
To perform its functions, PurpleTools must be able to read information already displayed in the EHR.
PurpleTools RAF, for example, may locally examine diagnoses, ICD-10 codes, BMI values, or laboratory values such as eGFR. PurpleTools Clicks may locally examine medications, diagnoses, laboratory information, note status, and EHR controls. PurpleTools Athena uses the same general approach within Athena.
All of this clinical processing occurs inside Chrome.
This is an important distinction. An extension can read information displayed on an EHR webpage without transmitting that information anywhere else. PurpleTools reads and processes the information locally; it does not send the clinical information to PurpleTools Medical.
Internet Communications Are Limited to Administrative Functions
Like most commercial software, PurpleTools uses Internet communications for certain non-clinical functions, including Chrome Web Store installation and updates, trial activation, licensing, subscription verification, account administration, and payment processing.
These systems may handle information such as an email address, subscription status, license status, or payment information.
They are separate from the clinical functions of PurpleTools.
Patient charts, diagnoses, medications, laboratory results, and clinical documentation are not included in these communications.
Why This Is Important for HIPAA
HIPAA regulates the use, disclosure, transmission, and protection of protected health information.
PurpleTools operates within an EHR where PHI is already available to an authorized healthcare professional. Rather than copying that information to another company's server, PurpleTools performs its clinical functions locally within the browser.
This avoids creating a second cloud repository of patient information and avoids transmitting clinical data to PurpleTools Medical for analysis.
The U.S. Department of Health and Human Services distinguishes between a company that supplies software and a company that receives or maintains PHI on behalf of a healthcare organization. That distinction is important when healthcare organizations evaluate software vendors and potential Business Associate relationships.
PurpleTools was specifically designed so that routine clinical operation does not require PurpleTools Medical to receive patient PHI.
HIPAA Compliance and Product Certification
Neither HHS nor another federal agency provides a general certification declaring an individual software product "HIPAA certified."
HIPAA compliance depends on how technology is deployed and used within the healthcare organization, including its access controls, workstation security, network security, administrative policies, physical safeguards, employee practices, and risk-management program.
Accordingly, PurpleTools Medical does not claim that installation of the software alone makes an organization HIPAA compliant.
What PurpleTools can state definitively is that its clinical functions do not transmit patient or clinical information to PurpleTools Medical.
That is an important factor for a hospital, medical group, ACO, or other healthcare organization conducting its own HIPAA and security review.
Google Chrome Web Store Review
PurpleTools RAF, PurpleTools Clicks, and PurpleTools Athena are distributed through the Google Chrome Web Store.
Google requires Chrome extensions to comply with its Developer Program Policies. Extensions are reviewed for issues involving privacy, data handling, permissions, malware, deceptive behavior, unauthorized collection of information, and required user disclosures.
Google also requires developers to accurately disclose what types of information an extension can access and why that access is necessary. Extensions are expected to request only the permissions needed for their stated purpose, and published extensions remain subject to Google's continuing review and enforcement.
An extension that violates these policies can be rejected or removed from the Chrome Web Store.
Chrome Web Store acceptance therefore provides an additional independent level of review. It should not be confused with HIPAA certification, but it does demonstrate that the extension has been accepted for distribution under Google's privacy, security, data-use, and extension policies.
Understanding Google's Health-Information Disclosure
A healthcare organization reviewing a Chrome Web Store listing may see a disclosure stating that an extension handles health information.
That does not necessarily mean that the information is transmitted to the developer.
PurpleTools must be able to read clinical information because its functions occur inside an EHR. Google therefore requires disclosure of that access.
For PurpleTools, the information is read and processed locally in Chrome and is not transmitted to PurpleTools Medical.
This distinction is central to understanding the PurpleTools privacy model.
Google's Privacy Requirements
Google requires Chrome extensions to clearly identify their purpose and disclose how user information is handled. It also restricts the sale, transfer, and unrelated use of information obtained through an extension.
PurpleTools uses EHR information only to perform its healthcare workflow and coding-support functions. Patient information is not used for advertising, marketing profiles, data brokerage, lending decisions, or unrelated commercial purposes.
More fundamentally, PurpleTools Medical does not receive the clinical information in the first place.
Institutional Control
Hospitals and larger healthcare organizations can also manage PurpleTools through Google Chrome Enterprise.
An IT department can approve or block specific extensions, centrally deploy approved extensions, restrict extension permissions, limit the websites on which an extension can operate, and remove extensions centrally.
This allows an organization to review PurpleTools through its normal information-security process and maintain control over its deployment.
Summary for Healthcare Organizations
For a hospital, health system, medical group, ACO, or compliance department evaluating PurpleTools, the principal privacy and security characteristics are:
The Bottom Line
PurpleTools Medical was designed to perform useful EHR functions without creating another destination for patient information.
The clinical data stays in the healthcare organization's EHR and the user's Chrome browser. PurpleTools works with that information locally and does not transmit it to PurpleTools Medical across the Internet.
For healthcare organizations evaluating PurpleTools, that local-processing architecture is the central privacy and security feature of the product.